From d5a4e3f06f53d3219abd4e648ac3983e00a1dbe5 Mon Sep 17 00:00:00 2001 From: root Date: Tue, 16 Feb 2021 19:16:55 +0000 Subject: [PATCH] Added detection testing service results inDetect regsvcs with no Command Line Arguments --- .../detect_regsvcs_with_no_command_line_arguments.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml index dd88cc2b02..b20bd1e4e7 100644 --- a/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml +++ b/detections/endpoint/detect_regsvcs_with_no_command_line_arguments.yml @@ -11,9 +11,9 @@ description: The following analytic identifies regsvcs.exe with no command line how_to_implement: To successfully implement this search, you need to be ingesting logs with the process name, parent process, and command-line executions from your endpoints. If you are using Sysmon, you must have at least version 6.0.4 of the - Sysmon TA. + Sysmon TA. type: batch -datamodel: [] +datamodel: [] references: - https://attack.mitre.org/techniques/T1218/009/ - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1218.009/T1218.009.md @@ -24,7 +24,9 @@ search: '`sysmon` EventID=1 (process_name=regsvcs.exe OR OriginalFileName=RegSvc max(_time) as lastTime by dest, User, ParentImage,ParentCommandLine, process_name, OriginalFileName, process_path, CommandLine | rename Computer as dest | `security_content_ctime(firstTime)` | `security_content_ctime(lastTime)` | `detect_regsvcs_with_no_command_line_arguments_filter`' -known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause a false positive. Filter based endpoint usage, command line arguments, or process lineage. +known_false_positives: Although unlikely, limited instances of regsvcs.exe may cause + a false positive. Filter based endpoint usage, command line arguments, or process + lineage. tags: analytic_story: - Suspicious Regasm Regsvcs Activity @@ -45,3 +47,4 @@ tags: asset_type: Endpoint dataset: - https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1218.009/atomic_red_team/windows-sysmon.log + automated_detection_testing: passed